Saviynt unveils its cutting-edge Intelligence Suite products to revolutionize Identity Security!
Click HERE to see how Saviynt Intelligence is transforming the industry.
Saviynt Copilot Icon

LDAP - Unable to map account and entitlements

pschoch
New Contributor
New Contributor

We have a connection setup with Tivoli LDAP. We are able to import Accounts and Entitlements, but the association between account-entitlements is not mapping. 

groupImportMapping:

{
"importGroupHierarchy": "true",
"entitlementTypeName": "uniqueMember",
"performGroupAccountLinking": "true",
"incrementalTimeField": "whenChanged",
"groupObjectClass": "(objectClass=groupOfUniqueNames)",
"groupAccountMappingAttributeName":"uniquemember",
"mapping":"memberHash:uniquemember_char,customProperty12:nameinnamespace_char,customProperty13:cn_char,entitlement_value:nameinnamespace_char,entitlementID:nameinnamespace_char,DISPLAYNAME:cn_char,RECONCILATION_FIELD:entitlement_value"
}

 We've confirmed 'uniquemember' property contains the list of accounts in distinguishname format. 

And have account_attribute setup 

ACCOUNTID::nameinnamespace#String

 

8 REPLIES 8

rushikeshvartak
All-Star
All-Star

. Ensure Proper DN Format in Account Attributes

  • Since the uniquemember field holds the DN of accounts, make sure that the nameinnamespace field in the account is populated correctly and in the proper DN format.
  • Verify that the value of nameinnamespace matches the format of the DN in uniquemember, as this field is being used for mapping.

2. Check the groupAccountMappingAttributeName Configuration

  • The groupAccountMappingAttributeName is currently set to uniquemember, which is correct for your case as uniquemember holds the DNs of accounts.
  • This field should correctly link the accounts listed under uniquemember to the nameinnamespace in the account, as it is being used to reconcile them.

3. Review Account Attribute Mapping

  • In the account attribute setup, you have ACCOUNTID::nameinnamespace#String. Ensure that nameinnamespace is populated in the correct format, and that it matches the values in the uniquemember property of the entitlements.

Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

stalluri
Valued Contributor II
Valued Contributor II

@pschoch 
Along with the below, can you also make sure you're selecting 
ENTITLEMENT_ATTRIBUTE as uniqueMember


Best Regards,
Sam Talluri
If you find this a helpful response, kindly consider selecting Accept As Solution and clicking on the kudos button.

pschoch
New Contributor
New Contributor

@rushikeshvartak 

I can confirm the dn formatting of accounts, defined by nameinnamespace, matches the dn format in the uniquemember property. We populated a customproperty with the value of uniquemember and format matches.

For example, the given account:

AccountID: employeeNumber=123456,ou=People,o=xxx,c=ca

and given entitlement that has uniquemember attribute as:

 [employeeNumber=123456,ou=People,o=xxx,c=ca, employeeNumber=123457,ou=People,o=xxx,c=ca]

@stalluri 

Also can confirm, ENTITLEMENT_ATTRIBUTE is defined as uniqueMember

NM
Honored Contributor II
Honored Contributor II

@pschoch , can you try one thing.

Run account import see if it maps account and entitlement then access see if it anyway it changes it?

Could you kindly provide a detailed snapshot of the information extracted from the logs, encompassing errors and other pertinent functionality details encountered during the execution of this process? Your assistance in furnishing this information would greatly aid in the analysis and resolution of any issues .



‼️‼️⚠️Do not upload any attachments that contain sensitive information, such as IP Addresses, URLs, Company/Employee Names, Email Addresses, etc.⚠️‼️‼️


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

pschoch
New Contributor
New Contributor

Is there a search term i should be looking for in the logs? There's no errors within the runtime window. I see all the expected entitlements and accounts imported, the counts are correct. 

The one thing i noticed near the end of the runtime is several entries that show as the following, almost like its trying to associate values in the dn value.

pschoch_0-1725632803280.png

 

There is no particular keyword need to dig into logs


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

NM
Honored Contributor II
Honored Contributor II

@pschoch I will say share logs in text format